Privacy policy
What we hold, and why.
Short version: an email address, a password we can't read, and what you did in the cases. No advertising trackers, no selling anything to anyone.
In effect from 29 July 2026
Draft · This policy is awaiting professional review. It states our actual practice, but treat it as a working document until this note is gone.
Contents
Who this policy is from
redthread.co.in (“RedThread”, “we”) is operated by TODO — registered legal name, TODO — street address, Mumbai, Maharashtra, 400002, India. Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the data fiduciary for the personal data described here — we decide what is collected and why. You are the data principal.
This policy covers the website and the game. It does not cover anything you do on a third-party site we link to.
What we collect
Account data, because an archive that remembers your progress needs to know who you are: the name you choose to display, your email address, and a one-way hash of your password. We never store the password itself and cannot recover it. If you sign in with Google, we receive your name, email address and the fact that Google verified it — nothing else, and no access to your Google account.
Gameplay data, because it is the game: which cases you opened and when, verdicts filed and whether they were correct, hunches pulled, scores, solve times, and your ratings and written feedback on cases.
Room data, if you play a case with other people: the room you joined, who else was in it, and the messages you send in that room while it is live.
Technical data, to keep the service standing up: your IP address and request metadata, used for rate limiting, abuse prevention and error logs.
What stays on your device. Your notes, corkboard, pinned evidence and toolkit findings are kept in your browser’s local storage and are never sent to us. Clear your browser data and they are gone — we cannot restore them.
Why we process it, and on what basis
Under the DPDP Act we process personal data either with your consent or for a “legitimate use” the Act permits — principally, providing a service you have voluntarily asked for.
- To give you an account and keep it secure — sign-in, email verification, password reset, session management.
- To run the game — progress, scoring, standings, multiplayer rooms.
- To improve the cases — aggregate ratings and your written feedback tell us which files are unfair or broken.
- To protect the service — rate limiting, fraud and abuse prevention, audit logs of administrative actions.
- To meet legal obligations — including tax and accounting records once payments are live.
We do not use your data to build advertising profiles, and we do not sell or rent personal data. Ever.
Who else touches your data
We use a small number of service providers (“data processors”) who handle data only on our instructions:
- Cloud hosting and content delivery, to serve the site.
- A managed database provider, which stores your account and gameplay records.
- A content platform, which stores the case files themselves (no personal data).
- An email delivery provider, for verification and password-reset mail.
- Real-time infrastructure, which carries multiplayer room traffic while a room is live.
- When payments launch: a payment gateway registered in India, which handles the transaction. Card and bank details go to them directly and are never stored on our servers.
We also disclose data where the law requires it — a valid order from a court or a competent authority — and to advisers, in confidence, where necessary to protect our legal rights.
Where your data is processed
Some of our providers operate servers outside India. Where data is transferred out of India we do so in line with the DPDP Act and only to jurisdictions not restricted by the Central Government, under contracts that hold the provider to the protections in this policy.
How long we keep it
Account and gameplay data is kept while your account exists, because it is your account. Delete your account and we erase your personal data within 30 days, except where a law requires us to keep a record (for example, transaction records for tax purposes) — those are kept for the statutory period and nothing longer.
Room messages are held only while a room is live and are discarded when it closes. Technical logs are kept for up to 90 days. Anonymous, aggregated statistics — how many people solved a case, an average rating — carry no identifier and may be kept indefinitely.
Your rights
Under the DPDP Act you may:
- Ask what personal data we hold about you and who we have shared it with.
- Have inaccurate or incomplete data corrected, or have it updated.
- Have your data erased, unless we are required by law to keep it.
- Withdraw consent at any time — as easily as you gave it. Withdrawing consent for essential processing means closing your account.
- Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
- Complain to us, and — if we do not resolve it — to the Data Protection Board of India.
Write to redthreadcasefiles@gmail.com to exercise any of these. We will respond within 15 days. We may ask you to confirm your identity first, so that nobody else can make a request about your data.
Children
RedThread is intended for adults. The DPDP Act treats anyone under 18 as a child and requires verifiable consent from a parent or guardian before their data is processed. If you are under 18, use RedThread only with your parent or guardian’s consent. We do not knowingly process a child’s data without it, and we never track children or serve them targeted advertising. If you believe a child has given us data without consent, write to us and we will erase it.
How we protect it
Passwords are stored as bcrypt hashes. Sessions use signed tokens that are invalidated whenever a password changes, so a stolen session on another device dies with the password. Traffic runs over HTTPS, sign-in and sign-up are rate limited, and administrative actions are logged.
No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.
Payments
RedThread is currently free and we take no payments. When paid access launches, it will run through a payment gateway registered in India: we will receive a transaction reference, the amount, its status and the billing details needed for an invoice, while full card, UPI and bank details go to the gateway directly and never reach our servers. This section will be updated, and the change announced, before any payment is taken.
See the refunds and cancellation policy for what happens to a payment that goes wrong.
Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects how we use your data, we will tell you by email or in the app before it takes effect.
Contacting us
- Data fiduciary
- TODO — registered legal name
- Grievance officer
- Anakin Knight
- Postal address
- TODO — street address, Mumbai, Maharashtra, 400002, India